Repository navigation
net/http: memory exhaustion in Request.ParseForm (CVE-2025-61726) #77101
Description
Activity
@gopherbot please open backport issues for this security fix
Backport issue(s) opened: #77107 (for 1.24), #77108 (for 1.25).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
Change https://go.dev/cl/736723 mentions this issue:
[release-branch.go1.25] net/url: add urlmaxqueryparams GODEBUG to limit the number of query parametersChange https://go.dev/cl/736702 mentions this issue:
[release-branch.go1.24] net/url: add urlmaxqueryparams GODEBUG to limit the number of query parametersChange https://go.dev/cl/736707 mentions this issue:
[release-branch.go1.26] net/url: add urlmaxqueryparams GODEBUG to limit the number of query parametersChange https://go.dev/cl/736712 mentions this issue:
net/url: add urlmaxqueryparams GODEBUG to limit the number of query parameters- changed the title
[-]security: fix CVE-2025-61726[/-][+]net/http: memory exhaustion in Request.ParseForm (CVE-2025-61726)[/+]on Jan 15, 2026 Change https://go.dev/cl/737040 mentions this issue:
doc: fix urlmaxqueryparams typos- added a commit that references this issue
on Jan 16, 2026 - added a commit that references this issue
on Jan 29, 2026 - added a commit that references this issue
on Mar 24, 2026 - added a commit that references this issue
on Jul 22, 2026 - added a commit that references this issue
on Sep 4, 2026
When parsing a URL-encoded form net/http may allocate an unexpected amount of
memory when provided a large number of key-value pairs. This can result in a
denial of service due to memory exhaustion.
Thanks to jub0bs for reporting this issue.
This is CVE-2025-61726 and Go issue https://go.dev/issue/77101.
This is a PRIVATE issue for CVE-2025-61726, tracked in http://b/457464435 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/3020.
/cc @golang/security and @golang/release